popup

Submissions

No Date Request Urls Hosts IDS Rule Score Zero VT Player Etc
12976 2021-10-01 09:29 bita.exe  

8d62813dea222d240b0170fd581d97f4


RAT PWS .NET framework Generic Malware Admin Tool (Sysinternals etc ...) PE File .NET EXE PE32 VirusTotal Malware Check memory Checks debugger unpack itself Check virtual network interfaces Tofsee 		1 4 1 2.4 20 ZeroCERT

12977 2021-10-01 09:31 EXCEL.exe  

cb12b24b0f69225693168e9c35761a1b


RAT Generic Malware Antivirus AntiDebug AntiVM PE File .NET EXE PE32 MSOffice File VirusTotal Malware powershell Buffer PE suspicious privilege Code Injection Check memory Checks debugger buffers extracted Creates shortcut RWX flags setting exploit crash unpack itself Windows utilities Disables Windows Security suspicious process WriteConsoleW Windows Exploit ComputerName Cryptographic key crashed 		15.0 M 24 ZeroCERT

12978 2021-10-01 09:31 kellyzx.exe  

37f317fa15efe727f89ad47f18938ed9


PWS .NET framework Generic Malware SMTP KeyLogger AntiDebug AntiVM PE File .NET EXE PE32 VirusTotal Malware AutoRuns suspicious privilege Code Injection Check memory Checks debugger buffers extracted unpack itself Windows ComputerName crashed 		10.0 M 25 ZeroCERT

12979 2021-10-01 09:33 vbc.exe  

a0251851e3f228572dd892e7005d5126


Malicious Library PE File PE32 VirusTotal Malware PDB unpack itself Remote Code Execution 		2.0 M 22 ZeroCERT

12980 2021-10-01 09:34 WORD.exe  

102a4d939738d2c875503b14f99c0aeb


RAT Generic Malware Antivirus DNS AntiDebug AntiVM PE File .NET EXE PE32 VirusTotal Malware powershell Buffer PE AutoRuns suspicious privilege MachineGuid Code Injection Check memory Checks debugger buffers extracted Creates shortcut unpack itself Windows utilities powershell.exe wrote suspicious process WriteConsoleW human activity check Windows ComputerName DNS Cryptographic key DDNS crashed 		2 1 15.2 M 31 ZeroCERT

12981 2021-10-01 09:35 agent.exe  

2068a3d903424475d6a7bf87c5ed3a16


PWS .NET framework Generic Malware SMTP KeyLogger AntiDebug AntiVM PE File .NET EXE PE32 VirusTotal Malware suspicious privilege Code Injection Check memory Checks debugger buffers extracted unpack itself Windows utilities Checks Bios Detects VirtualBox suspicious process malicious URLs WriteConsoleW VMware anti-virtualization Windows ComputerName Software crashed 		14.2 M 27 ZeroCERT

12982 2021-10-01 09:36 lt.exe  

a352af3641e56203e59b69fa73cf116b


PWS .NET framework Generic Malware DNS AntiDebug AntiVM PE File .NET EXE PE32 VirusTotal Malware Buffer PE suspicious privilege MachineGuid Code Injection Check memory Checks debugger buffers extracted unpack itself Windows utilities suspicious process WriteConsoleW human activity check Windows ComputerName DNS 		1 15.6 M 24 ZeroCERT

12983 2021-10-01 09:37 blessedzx.exe  

bcbc4c86832c1bf89fa8521f6787642e


Generic Malware DNS AntiDebug AntiVM PE File .NET EXE PE32 VirusTotal Malware Buffer PE AutoRuns suspicious privilege MachineGuid Code Injection Check memory Checks debugger buffers extracted unpack itself Windows utilities suspicious process WriteConsoleW human activity check Windows ComputerName DNS DDNS 		2 1 15.4 M 22 ZeroCERT

12984 2021-10-01 09:38 faba50s4e01t22barcode.exe  

c5687cde262a0776027b2f73f1266a79


NPKI Generic Malware UPX Malicious Library ASPack Malicious Packer Admin Tool (Sysinternals etc ...) PE File OS Processor Check PE32 PNG Format DLL VirusTotal Malware AutoRuns Malicious Traffic Checks debugger Creates executable files unpack itself suspicious process AppData folder sandbox evasion anti-virtualization Windows 		1 2 6.2 M 38 ZeroCERT

12985 2021-10-01 09:39 vbc.exe  

d62969a4f821658faf7d02b6dbd994d6


Generic Malware UPX PE File PE32 VirusTotal Malware Check memory RWX flags setting unpack itself Remote Code Execution 		2.4 M 28 ZeroCERT

12986 2021-10-01 09:42 remcos.exe  

76c164f0b7f1cf159db8f378fe55008f


AgentTesla PWS .NET framework browser info stealer Generic Malware Google Chrome User Data Socket Create Service Sniff Audio Escalate priviledges KeyLogger Code injection Internet API Downloader AntiDebug AntiVM PE File .NET EXE PE32 VirusTotal Malware Buffer PE suspicious privilege Code Injection Check memory Checks debugger buffers extracted unpack itself Windows utilities suspicious process malicious URLs WriteConsoleW Windows ComputerName DNS keylogger 		1 12.4 M 19 ZeroCERT

12987 2021-10-01 09:42 oii.exe  

e1be4d5a120b60f3e06225f7e8bbccd2


RAT Generic Malware AntiDebug AntiVM PE File .NET EXE PE32 FormBook Malware download VirusTotal Malware suspicious privilege Code Injection Malicious Traffic Check memory Checks debugger buffers extracted unpack itself Remote Code Execution 		28 28 2 16 8.4 M 15 ZeroCERT

12988 2021-10-01 09:42 trick.exe  

4668a8be8db5bc23fcd4e0b2a237658b


Emotet Gen1 UPX Malicious Library PE File OS Processor Check PE32 Dridex TrickBot VirusTotal Malware suspicious privilege MachineGuid Malicious Traffic buffers extracted unpack itself Check virtual network interfaces suspicious process Tofsee Kovter ComputerName DNS crashed 		6 6 3 6.8 M 43 ZeroCERT

12989 2021-10-01 09:44 raccon.exe  

4d14cf426d5bba34e1da4a2cc98b0b57


Malicious Library PE File PE32 VirusTotal Malware PDB unpack itself Remote Code Execution 		1.8 M 19 ZeroCERT

12990 2021-10-01 09:47 SalmonFlora.exe  

e277207bfd455a387fe52aaa65f4e9b0


VMProtect Malicious Library PE File PE32 VirusTotal Malware Check memory unpack itself 		2.6 M 36 ZeroCERT

keyword